Increased modelling credibility required for cyber catastrophe risks

Cyber catastrophe risk is inherently difficult to model and price, and the insurance industry is hampered by a lack of tangible scenario data points, inconsistent or non-existent cyber catastrophe claims coding frameworks and an overarching high level of uncertainty, according to Gallagher Re. In a new report, The Risk of a Cyber Catastrophe, the reinsurance broker notes that cyber insurance is an evolving, rapidly growing market, but it has never had to deal with such a catastrophe. Cyber modelling remains in its relative infancy and there is substantial divergence in the modelling of larger scenarios, which does not inspire confidence among capital providers, says Gallagher Re. In response, the (re)insurance sector is managing its exposures through appetite, pricing, tighter wordings and exclusions. “Demand for cyber insurance continues to grow, and following triple-digit rate rises in the past three years, insurers can have more confidence they are pricing the risk correctly. But while the supply of capital is increasing in parts of the market, there remains a reluctance from capital providers to offer cost-effective and systemic solutions that solve for carriers’ true fear of the unknown,” says the report. It adds that corporates are also seeking routes to mitigate their risks, and there has been considerable progress from the cybersecurity industry since 2017’s NotPetya attack in reducing vulnerability to attacks. But modelling is key, and model providers are investing in improving their capabilities, though Gallagher Re says the (re)insurance industry will require more and better data from insured clients on their cyber vulnerabilities and loss experience to improve models – and hence pricing. “There are many challenges around the cyber market today and this is only going to intensify as the class grows. Gallagher Re has long held the view that cyber is going to become the most capital- and expertise-constrained class within the insurance industry. We have invested in a team that is uniquely equipped to help our partners navigate these challenges, some of which are described in this paper,” says Ian Newman, global head of cyber, Gallagher Re. Iain Willis, research director at the Gallagher Research Centre, sees the need for further development of the models as a critical factor for capturing and understanding cyber risks. “Models that can capture a risk more precisely allow for the development of products and pragmatic pricing. The old adage that ‘models make markets’ tends to ring true. The concern currently would be that the divergence of existing model output shows the wide range of uncertainty in this peril. This is where research can really help,” he says. The report says increased modelling credibility will be important for unlocking more capacity and bringing in new capital providers to the reinsurance market, including through nontraditional routes, such as insurance-linked securities. For Simon Heather, head of cyber cat modelling, Gallagher Re, there’s another modelling challenge the industry needs to meet – the (re)insurance sector’s reliance on nat cats as a basis for modelling cyber cats. “We need a new approach not wholly based on established practices. We need to dislocate cyber from the familiarity of nat cat model frameworks,” Heather says. “Cyber events behave more like a pandemic than an earthquake or hurricane.” When a nat cat and a cyber cat are compared side by side, many important differences emerge. The duration of a cyber cat may be much longer; nat cats behave predictably, cyber cats do not and can have peaks and troughs of claims; and cyber is a class in which the policyholder’s behaviour has a far greater impact on the nature of their risk. The report calls for greater disclosure and transparency among the cyber community. “At present, the regulatory environment tends to compel organisations to disclose only when they have fallen victim to a data breach. Gallagher Re believes that the focus for disclosure should not be solely on successful attacks, and there is value in being open about near misses.

Increased modelling credibility required for cyber catastrophe risks

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Related Articles